fix(shares): reserved key leaked into the crossdrive_completed hub event

Found by LIVE VALIDATION, not by a unit test: the first demo tier-2 run pushed
'Masodlagos mentes elkeszult: _shares' — the reserved key reached Hungarian
customer/operator copy.

Mapped at the SOURCE of the notification (RunSharesTier2's tier2Notify calls) so no
future notifier wiring can reintroduce it, plus DisplayStackName at the main.go
wiring as idempotent defense in depth. Regression test added with a red-proof.

controller/cmd/controller/main.go

@@ -559,14 +559,18 @@ func main() {
 		// Tier 2: off-drive copy of each HDD app's recovery unit + userdata (auto-enabled, auto-target).
 		// Runs after the DB dump so it copies a fresh unit.
 		backupMgr.SetTier2Notifier(func(stackName, destLabel string, dur time.Duration, err error) {
+			// DISPLAY BOUNDARY (R-7b): this event's StackName lands in Hungarian operator/customer copy
+			// ("Másodlagos mentés elkészült: <név>"), so the reserved shares key is mapped here. Caught
+			// by live validation — the first demo run pushed a literal "_shares" before this line.
+			display := backup.DisplayStackName(stackName)
 			if err != nil {
 				notifier.NotifyCrossDriveFailed(notify.CrossDriveDetails{
-					StackName: stackName, Method: "rsync", DestPath: destLabel,
+					StackName: display, Method: "rsync", DestPath: destLabel,
 					Duration: dur.Round(time.Second).String(), Error: err.Error(),
 				})
 			} else {
 				notifier.NotifyCrossDriveCompleted(notify.CrossDriveDetails{
-					StackName: stackName, Method: "rsync", DestPath: destLabel,
+					StackName: display, Method: "rsync", DestPath: destLabel,
 					Duration: dur.Round(time.Second).String(),
 				})
 			}